diff --git a/migration/vyos-unifi-switch b/migration/vyos-unifi-switch index 945ceed..df18ee6 100755 --- a/migration/vyos-unifi-switch +++ b/migration/vyos-unifi-switch @@ -171,13 +171,30 @@ health_checks() { # no PPPoE stanza is a lab/partial delta, and failing it on a missing # pppoe0 would make the script untestable anywhere but the live cutover. # Announced loudly, because a quietly skipped check is worse than no check. - if grep -q "^set interfaces pppoe" "$DELTA"; then + if grep -qE "^set interfaces (pppoe|bonding bond0 vif 5)" "$DELTA"; then + # What matters is that SOME WAN works, not that every WAN works. + # + # This reverted a cutover that had genuinely succeeded. The 10 gig line came + # up on bond0.53 and the cloned MAC was handed the same public address the + # USG had (87.192.101.48); kea was serving real LAN clients at the same + # moment. The only failure was pppoe0 -- the Vodafone FAILOVER line -- and + # requiring it undid a working gateway. + # # Written as [ -n "$(...)" ] rather than `... | grep -q` for the pipefail # reason above: a pipeline ending in grep -q cannot be trusted here. - _chk "pppoe0 has an address" '[ -n "$(ip -4 -br addr show pppoe0 2>/dev/null | awk "{print \$3}")" ]' _chk "a default route exists" '[ -n "$(ip -4 route show default)" ]' _chk "internet reachable" "ping -c2 -W3 8.8.8.8" _chk "DNS resolves through us" "getent hosts vyos.net" + + # Informational only: report each WAN, fail on neither. A failover line + # being down is worth seeing, not worth reverting for. + for _w in pppoe0 bond0.53; do + if [ -n "$(ip -4 -br addr show "$_w" 2>/dev/null | awk '{print $3}')" ]; then + say " ok WAN $_w has an address (informational)" + else + say " note WAN $_w has no address (informational, not fatal)" + fi + done else warn "this delta configures no WAN -- skipping all WAN health checks." warn "That is expected in the lab and WRONG for the real cutover."